Privacy Notice

1. Who handles your information

Evidize LLC operates the U.S. Evidize website and platform. This notice covers accounts, applications, interviews and candidate device screening.

Evidize: we use information to run the service, manage accounts, provide support and protect access. We also process hiring information for customer organizations under our agreements with them.

The hiring organization: it chooses the job criteria and makes hiring decisions. It must provide any notice required for its own collection or hiring use. Ask the hiring contact for that notice and its data practices.

The state guide explains additional rights and notices. You can make a privacy or hiring-process request without accepting an employer's commercial contract.

2. What we collect and why

The information collected depends on the features used. The categories below identify the sources, purposes and factors that determine retention. Section 6 explains who receives information. The final category-specific retention schedules are among the company details being completed.

Website visits

Information and source: your browser supplies an IP address, browser/device details, pages requested, request identifiers, times and errors. We can estimate city, region and country from your IP address without requesting GPS location. Use: display and localize pages, fix problems and protect the service. Retention: the relevant service-log period and any investigation.

Checks for automated submissions

Information and source: where Cloudflare Turnstile is enabled for applications or organization signup, your browser connects to Cloudflare. The service sends a verification code and, when available, your IP address to Cloudflare for validation. Use: prevent automated abuse. Retention: verification, fraud or security needs, and the applicable service-provider and log schedules.

Accounts and subscriptions

Information and source: you, your organization and enabled sign-in services provide names, email addresses, organization and contact details, roles, permissions, sign-in records and subscription information. Use: manage accounts, access and the customer relationship. Retention: the account relationship, transactions, disputes, security needs and required business records.

Applications, interviews and assessments

Information and source: you and hiring users provide contact details, résumés, work and education history, skills, answers, professional links, interview times, meeting links, assessment materials, notes and scorecards. The service can produce extracted text, summaries, assessments of qualifications, scores, rankings, flags and decision reasons. Relevant AI inputs and outputs may form part of the hiring evidence. Use: manage applications, assess the disclosed job criteria, schedule interviews and support decisions. Retention: the hiring purpose, applicable record periods, later personnel actions, corrections, complaints and legal preservation needs.

Residence and assessment location

Information and source: you or the hiring organization provide your residence, job and office locations, and where you are taking an assessment. New York residents may be asked whether they live in New York City. Use: identify the rules for the particular activity. These are separate facts; an IP address or résumé alone does not determine legal coverage. Retention: the related hiring record and the need to explain which rules applied.

Device screening and security

Information and source: enabled checks collect running application names and identifiers, file locations and file-identification codes, computer user information, network addresses and service names, clipboard-event details, display count and layout, times and check status. File locations and usernames can identify you. The service also creates security identifiers to detect duplicate or abusive submissions. Use: run the disclosed checks, protect meeting access and support authorized review. Retention: the session, any security investigation and applicable hiring-record periods. Section 4 explains what stays on your device.

Voluntary demographic and sensitive information

Information and source: optional demographic answers can include gender identity, race, ethnicity and veteran status. An accommodation request or material you submit may contain health or other sensitive information. Use: the stated voluntary reporting purpose, assistance and responding to requests. Demographic answers are stored separately from ordinary application records. Retention: the reporting or request purpose, required hiring records and any dispute or preservation need.

Communications and request records

Information and source: you, hiring users and delivery services provide messages, recipient and delivery details, request references and outcomes. We record notices shown, document versions, reviews, responses, exports and other service actions. Use: communicate, provide support, handle requests and document what happened. Retention: resolution and appeals, delivery problems, and applicable communication and recordkeeping periods.

Cookies and browser storage

Information and source: your browser stores sign-in details, the organization selected, preferences and unfinished forms, which may include candidate or interview information. Microsoft sign-in can also store account details and codes that keep you signed in. Use: keep sessions working and save preferences or drafts. Retention: the item's expiry, the session, completion of the form or clearing of browser storage. Some drafts remain after sign-out.

3. Microsoft 365, Outlook and communications

Microsoft Entra provides sign-in information. Your organization authorizes the connections it enables; Microsoft's permission screen shows the requested access.

The Outlook add-in can read the open message or appointment, including attendees, time, location and body, to identify the candidate and meeting link. It sends selected candidate and meeting details to Evidize, rather than the full message body as interview content. Outlook sends the invitation when the user chooses to send it. A separately enabled Microsoft Graph connection can provide profile information.

Disconnecting an integration does not delete existing hiring records. Email delivery and organization email connections are separate from sign-in.

The website inquiry form opens an email draft, which is sent only when you send it. An external scheduling service receives the information you give it under its own privacy notice.

4. What device screening checks

Your session notice lists the enabled checks before screening. Available checks depend on your operating system and session settings.

Clipboard: the Windows and macOS apps read clipboard text on your device to calculate its length. Windows may also read copied file names for that calculation. Uploaded events contain the type, length, timing and event details, not the clipboard text or copied file names.

Displays and network: checks report the number and arrangement of displays, not screenshots. Network checks report connection and service-name information, not communication contents or actual upload/download totals.

The app may keep information on your device while retrying uploads. Its cleanup removes confirmed uploads and limits remaining items by age and size when the app runs. Diagnostic records and server copies have separate retention periods.

A signal is not proof of misconduct. For access problems or an accommodation, use the session's assistance option or contact the hiring organization. Reading this notice is not permission for recording, biometric identification or every device check. Any required permission is requested for the specific activity.

5. AI analysis and hiring decisions

Evidize can analyze résumés, summarize applications, assess disclosed job criteria and produce scores, rankings and security signals. Some results use AI; others use fixed rules. Approved analysis and ranking can run automatically. A temporary meeting-access check is separate from a hiring decision.

When an AI feature is enabled, the Microsoft Azure AI Foundry integration can receive relevant résumé text, job criteria, interview or assessment material and instructions.

AI results can be inaccurate, incomplete or biased. The hiring organization makes its hiring decisions and handles any review required for that process. Evidize remains responsible for its own conduct and any duties arising from its actual developer, processor, employer-agent or reporting-company role. The employer's notice explains its decision process and any applicable access, opt-out or appeal rights.

This notice does not authorize general model training, unrelated uses or candidate profiles shared across customers. Supplier training terms and any proposed reuse must be addressed in the applicable agreement and notices.

6. Who receives information and website tracking

Information is available as needed for the stated purpose to:

• The hiring organization's authorized recruiters, hiring managers and administrators.
• Evidize staff handling operations, support, security and requests.
• Hosting, storage and AI providers, and enabled sign-in, email and communication providers.
• Cloudflare Turnstile where enabled for application or organization-signup checks.
• Professional advisers or authorities where disclosure is legally permitted or required.

Evidize uses Microsoft Azure for hosting, its database and file storage. The production resources reviewed for those services are configured in Central US. This does not establish that every provider operation or copy stays in that region. The hiring organization controls copies it downloads.

Website and Outlook tracking

The marketing site records interaction details in your browser, such as the page, selected feature or plan and where you clicked. It does not automatically send them to an analytics provider, load advertising software or install a third-party tracker that follows you across websites. Ordinary page requests still reach our hosting service.

In Outlook, a separately enabled monitoring provider can receive client-selection and interview-creation or error events, including the client identifier and which part of the workflow produced the event.

Do Not Track: our website does not change its behavior in response to this browser setting. Do Not Track is different from legally recognized opt-out signals such as Global Privacy Control.

Company-specific sale, sharing, provider and opt-out-signal details are being completed in the draft details below. Reading or acknowledging this notice does not exercise a separate privacy choice.

7. Keeping, deleting and protecting information

We use the category-specific criteria in section 2 with the applicable schedules and legal duties. Records may need to be kept after an application ends because of a later personnel action, request, complaint or legal preservation requirement.

Deletion requests are subject to applicable rights and exceptions. Required records may be retained, including a limited record of the request and response. Supplier, backup, device and customer copies are handled separately; submitting a request does not erase all copies immediately.

Organization permissions and service security controls restrict access to information.

8. Your requests and choices

Your rights depend on the state, activity and organization. They can include access or a copy, correction, deletion, an explanation, review, an accommodation or an opt-out from particular uses. Many consumer-privacy laws exclude employment information; separate employment protections still apply. The state guide explains the differences.

Where the California Consumer Privacy Act (CCPA) applies, you can request the categories and specific pieces of information collected, their sources, purposes for collection, sale or sharing, and recipient categories. You can request correction and deletion, subject to exceptions, without unlawful retaliation. If a business sells or shares your information, you can opt out. For covered uses of sensitive information, you can limit its use and disclosure. Automated-decision rights have separate effective dates and exceptions.

Make a request: use the request form or the contact in the completed notice. Identify the hiring organization if known. The form accepts access, correction, deletion, explanation, accommodation, decision review and privacy appeal requests. An authorized representative should explain their authority.

Appeal: where an appeal right applies, choose “Appeal a privacy request response”, identify the earlier request and explain what you want reconsidered. A denied appeal must include any further complaint instructions required by the applicable state law.

Other choices: the form's automated-decision opt-out option does not submit a sale, sharing or targeted-advertising opt-out, or a request to limit sensitive-information use. Use the specific method in the responsible organization's notice for those choices.

After submission: the form confirms receipt and provides a reference. The responsible team may need to verify identity or authority and coordinate with the hiring organization. Do not send identity documents unless requested through the verified process. If receipt is not confirmed, retry or contact the hiring organization or the published Evidize privacy contact.

The hiring organization handles questions about its criteria, decisions and accommodations. Where Evidize processes information on its behalf, we assist as required by law and lawful instructions, or explain why a request must be directed to the responsible organization. Evidize handles requests relating to its own covered processing. Covered consumer reports have separate reporting-agency access and dispute duties; a product label does not decide that role. A response limiting a request should explain the applicable reason.

9. Updates and company details

The Privacy Notice page shows the version and date, with earlier notices in the version history. Where the CCPA applies, the policy must be updated at least once every 12 months. We can send informational updates by email without asking for acceptance. Any legally required advance notice or new permission must precede a changed activity; an email or revised notice does not retroactively authorize a broader use.